CVE-2026-49840

The esl_recv_event() function reads the Content-Length header value using atol(), which can return a negative number. The result is directly passed to malloc(len + 1) without any verification of sign or value size. A malicious ESL peer or an attacker performing a man-in-the-middle attack can send a frame with a negative Content-Length, leading to improper memory allocation (heap buffer overflow) and consequently heap corruption or immediate crash of the process using libesl.

An attacker can remotely cause a crash of any process linked with the libesl library or corrupt heap memory, potentially opening the way for further compromise of system integrity or availability. The attack is possible before client authentication to the peer.

FreeSWITCH must be updated to version 1.11.1, in which the issue has been fixed. The patch is available in the official repository: https://github.com/signalwire/freeswitch/releases/tag/v1.11.1

FreeSWITCH in versions prior to 1.11.1 — all processes and applications linked with the libesl library.